A Liliu le La'uina o Faila i le Avanoa i Faila
E mafai e se tagata e pulea le lafoina i luga o faila ona tatala le faitotoa i se osofaiga atoa ma le vaivaiga o le lafoina o faila. Pe a tuufaatasia e le au atina'e igoa o faila ma auala e lafoina ai faila, e mafai e tagata osofaʻi ona tuʻuina atu igoa faila leaga pei ../../ma isi/passwd e sola ese ai mai faila ma maua ai faila taua. O lenei ituaiga o sopo'aga o le ala e liua ai se API faigofie e lafo i luga i se auala malosi e fa'aaoga ai le avanoa i faila, aemaise lava pe a fa'agaoioia le talosaga ma ni fa'atagaga maualuluga.
⚠️Fa'ata'ita'iga e le saogalemu, mo na'o fa'amoemoega fa'alea'oa'oga. Aua le fa'aaogaina i le gaosiga.
// Vulnerable upload handler, file upload vulnerability [HttpPost("/upload")] public async Task<IActionResult> Upload(IFormFile file) { var path = Path.Combine("uploads/", file.FileName); // No validation using var stream = new FileStream(path, FileMode.Create); await file.CopyToAsync(stream); return Ok("File uploaded!"); } E mafai e se tagata osofaʻi ona lafoina se faila e igoa ia ../../web.config e toe tusi pe faitau faila fa'atapula'aina, o se osofa'iga masani o le sopo'ia o le auala.
Lomiga saogalemu:
// Safe upload with validation and canonicalization [HttpPost("/upload")] public async Task<IActionResult> Upload(IFormFile file) { var fileName = Path.GetFileName(file.FileName); // strip directories var targetDir = Path.GetFullPath("uploads/"); var safePath = Path.Combine(targetDir, fileName); if (!safePath.StartsWith(targetDir)) return BadRequest("Invalid file path"); using var stream = new FileStream(safePath, FileMode.Create); await file.CopyToAsync(stream); return Ok("File securely uploaded!"); } Fa'amatalaga fa'alea'oa'oga: Fa'amaonia i taimi uma auala i Ala.MauaAlaFull() ma siaki pe o loʻo tumau pea le iʻuga i totonu o lau faila e lafoina i luga. Aua lava neʻi faʻatuatuaina se faila.IgoaFaila tuusao.
Mea Sese a le Atina'e e Mafai ai ona Sopoia le Ala
O le tele o vaivaiga o le lafoina o faila e mafua ai ona sopoia le auala e mafua mai i le faanatinatiina o le code ma le leai o se faamaoniga. O mea sese masani a le au atina'e e aofia ai:
- Fa'apipi'i sa'o o mea e ulufale i ai tagata fa'aoga i totonu o ala o faila faila
- Talitonu Anotusi-Ituaiga pe na'o le fa'amaoniga o le fa'aopoopoga
- Fa'ase'e le fa'atulagaina o auala a'o le'i sefeina
Toe fa'aaogaina o faila le tumau i talosaga po'o microservices
⚠️Fa'ata'ita'iga e le saogalemu, mo na'o fa'amoemoega fa'alea'oa'oga. Aua le fa'aaogaina i le gaosiga.
# Flask example vulnerable to path traversal attack @app.route('/upload', methods=['POST']) def upload(): file = request.files['file'] file.save('uploads/' + file.filename) return 'Uploaded' E mafai e tagata osofaʻi ona faʻatoʻilaloina lenei faʻasologa faigofie e sopoʻia ai faʻasinomaga (../../app.py) ma tusi pe toe tusi faila fa'afuase'i. Lomiga saogalemu:
# Safe file upload validation from werkzeug.utils import secure_filename @app.route('/upload', methods=['POST']) def upload(): file = request.files['file'] name = secure_filename(file.filename) path = os.path.join('uploads', name) file.save(path) return 'Securely uploaded' Fa'amatalaga fa'alea'oa'oga: Faaaoga fesoasoani ua saunia e le fa'avae e pei o igoa_faila_puipuia ma fa'amalosia fa'aopoopoga ua fa'atagaina. Aua ne'i fa'apipi'i lima mea ua ulufale i totonu o auala faila.
Fa'aaogāina Moni Pipelinema Auaunaga Laiti
E lē gata i nofoaga faitele e tutupu ai osofaʻiga o le sopoʻia o ala. E masani ona aliali mai i totonu. CI/CD faiga fa'akomepiuta, fale teu oloa fa'aonaponei, po'o microservices e pulea ai faila ua lafoina i luga. Mo se faʻataʻitaʻiga, o se vaivaiga o le lafoina o faila i totonu o se pule o mea taulima fausiaina e ono mafai ai e se tagata osofaʻi ona toe tusia tusitusiga fausiaina pe fa'aofi faila leaga i totonu o faila e fa'asoa fa'atasi.
⚠️Fa'ata'ita'iga e le saogalemu, mo na'o fa'amoemoega fa'alea'oa'oga. Aua le fa'aaogaina i le gaosiga.
# Never expose real tokens, credentials, or internal URLs in pipelines - name: Store build artifact run: cp $UPLOAD_PATH/$FILENAME /var/artifacts/$FILENAME If $FAILA IGOA e le'i fa'amaonia, o se mea ua faia ../../../ma isi/upu faataga e mafai e le valu ona toe tusia faila taua a le polokalama i le taimi o le faʻatinoina, o se osofaʻiga i le lalolagi moni. Lomiga saogalemu:
# Safer artifact storage guardrail - name: Store build artifact securely run: | SAFE_NAME=$(basename "$FILENAME") cp "$UPLOAD_PATH/$SAFE_NAME" /var/artifacts/"$SAFE_NAME" Fa'amatalaga fa'alea'oa'oga: In pipelines, fa'amamā uma fesuia'iga o ala fa'a-dynamic. Fa'atapula'a galuega tusitusi i faila fa'atonutonuina e puipuia ai le sola ese o faila i le taimi o fausiaina po'o fa'atinoina.
Puipuia o le Sopoia o Ala i le Upload Logic
O le fa'aitiitia o le sopo'ia o ala e amata i le fa'amaoniga malosi ma le vavae'eseina o fa'amatalaga. Ia taulima igoa o faila ma ala o ni fa'amatalaga e le fa'atuatuaina mai le amataga, aemaise lava pe a taulimaina faila ua lafoina i luga.
Taʻitaʻiga Lelei
- Fa'atulaga ma fa'amaonia auala uma a'o le'i fa'aaogaina.
- Fa'atapula'a le lafoina i luga i se fa'asinomaga fa'apitoa i fafo atu o le web root.
- Fa'amalosia lisi fa'atagaina mo fa'aopoopoga faila ma ituaiga MIME.
- Aua ne'i toe fa'aaogaina faila le tumau i le va o sauniga po'o tagata fa'aoga.
- Faaaoga le teuina i totonu o koneteina mo faila ua lafoina i luga pe a mafai.
Lisi siaki pu'upu'u e puipuia ai
- Fa'amaonia igoa faila uma i le Ala.Maua le IgoaFaila() pe tutusa.
- Foia auala atoa ma fa'amaonia tuaoi o le fa'asinomaga.
- Fa'aoga le fa'aopoopoga ma le lisi fa'atagaina o MIME.
- Faaaoga faila eseese e lafo i luga mo tagata taʻitasi poʻo le sauniga.
- Aofia ai le su'esu'eina ma le fa'amaoniaina o le uta i totonu CI/CD suega.
Fa'amatalaga fa'alea'oa'oga: O faila uma e taulimaina le lafoina i luga o faila o se auala e ono osofaʻia ai tagata. Fausia se puipuiga loloto e ala i le faʻamaonia, vavaeeseina, ma le suʻesuʻeina o tulafono uma e taulimaina ai faila.
Auala e Iloa ma Poloka ai e Xygeni Tafega o Lafoga e Le Saogalemu
Xygeni Code Security suʻega fa'avae tulafono ma pipelines e iloa ai mamanu o le sopoia o ala a'o le'i o'o i le gaosiga. E fa'ailoa ai le feso'ota'iga o ala e le saogalemu, misi le fa'atulagaina o fa'amaumauga, ma fa'agaioiga faila matautia i totonu o le code ma le CI/CD tusitusiga.
Vaega fa'atino, fa'atasi ai ma le puipui fa'atonutonu:
# Secure enforcement with Xygeni - name: Enforce secure upload and path handling run: dotnet xygeni enforce --rules uploads,path,security --fail-on-risk Fa'amatalaga fa'alea'oa'oga: Faʻatasia Xygeni i totonu ia te oe pipeline ia mautinoa o vaivaiga o le lafoina o faila ma osofaʻiga e ui atu i le auala e otometi lava ona maua i le taimi o le faʻamaoniga o le fausiaina.
Tapuni le Avanoa: Puipuia o Lau Osofa'iga e Sosoo ai i le Sopo'ia o Ala
O se faaletonu i le sopoia o le ala e tasi i totonu o se pito i tua o le lafoina o faila e mafai ona maua ai e tagata osofaʻi le avanoa i le faiga faila a lau 'auʻaunaga. Toe iloilo le au taulimaina o le lafoina i luga mo ni fa'asologa e le saogalemu, fa'atulaga auala uma, ma aua lava ne'i fa'atuatuaina igoa o faila e pulea e tagata fa'aoga. Faaopoopo meafaigaluega e su'esu'e ai vaivaiga pei Xygeni Code Security ia oe DevSecOps pipeline e iloa ai osofaʻiga e sopoia ai le auala ma vaivaiga o le laʻuina o faila aʻo leʻi lafoina. I le saogalemu, o faila uma e sefeina e tatau ona taulimaina o se code na faatinoina!
